Event Backlog Caused by Certificate Checked Events

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Increased Backlog shows several Events matching the Subtype: Certificate checked

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Cause

The Agent will routinely force the operating system to re-validate existing or new certificates. In environments with large numbers of Agents this can contribute to a significant portion of Events.

Resolution

If this information is not needed, consider adding an AB Exclusion to prevent the Events from being sent back to the Server:

1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
2. Select the Property ABExclusionRules and change the Value accordingly:
   • If a Value exists, copy & paste this to the end:

     |;;;;;;;1014;;;2

   • If a Value doesn't exist, copy & paste this:

     ;;;;;;;1014;;;2

3. Click Change to apply the new ABExclusion.

Additional Information

• ABExclusions are separated with the pipe character: |
• Trailing/Proceeding spaces are not supported in ABExclusions.